What is Acra
Acra helps you easily secure your databases in distributed, microservice-rich environments. It allows you to selectively encrypt sensitive records with strong multi-layer cryptography, detect potential intrusions and SQL injections and cryptographically compartmentalize data stored in large sharded schemes. Acra’s security model guarantees that if your database or your application get compromised, they will not leak sensitive data or decryption keys.
Acra gives you tools for encrypting the data on the application’s side into a special cryptographic container, storing it in the database, and then decrypt it in a secure compartmented area (separate virtual machine/container). The cryptographic design ensures that no secret (password, key, anything) leaked from the application or database will be sufficient for decryption of the protected data chunks that originate from it.
Acra was built with specific user experiences in mind:
- quick and easy integration of security instrumentation;
- cryptographic protection of data in the threat model where all the other parts of the infrastructure could be compromised, but as long as AcraServer isn’t compromised, the data is safe;
- proper abstraction of all cryptographic processes: you’re safe from the risk of selecting the wrong key length or algorithm padding;
- secure default settings to get you going;
- intrusion detection to let you know early that something wrong is going on;
- high degree of configurability to create the perfect balance between the extra security features and performance;
- automation/ops-friendly: most of Acra’s features were built to be easily configured/automated using a configuration automation environment.
- limited attack surface: to compromise an Acra-powered app, an attacker will need to compromise a separate compartmented server, AcraServer – more specifically – its key storage and database;
- easy to try: you can experience the full might of Acra without committing to its installation using Docker containers.
Acra is a continuously developing security tool. And as any proper security tool, it requires enormous human efforts for validation of the methods, code, and finding possible infrastructural weaknesses. Although we do run Acra in production in several instances, we’re constantly enhancing and improving it as we go. This is done to ensure that the provided security benefits are not rendered useless through implementation problems or increased complexity.
Cryptography
Acra relies on our cryptographic library Themis, which implements high-level cryptosystems based on the best available open-source implementations of the most reliable ciphers. Acra does not contain any self-made cryptographic primitives or obscure ciphers. Instead, to deliver its unique guarantees, Acra relies on the combination of well-known ciphers and smart key management scheme.
How does Acra work?
After successfully deploying and integrating Acra into your application, follow the 4 steps below:
- Your app talks to AcraConnector, local daemon, via PostgreSQL/MySQL driver. AcraConnector emulates your normal PostgreSQL/MySQL database, forwards all requests to AcraServer over a secure channel, and expects a plaintext output back.
- Then AcraConnector forwards it over the initial database connection to the application. It is connected to AcraServer via Secure Session or TLS, which ensures that the plaintext goes over a protected channel. It is highly desirable to run AcraConnector via a separate user to compartmentalize it from the client-facing code.
- AcraServer is the core entity that provides decryption services for all the encrypted envelopes that come from the database and then re-packs the database answers for the application. AcraCensor is a part of AcraServer that allows customizing the firewall rules for all the requests coming to the MySQL database.
- To write the protected data to the database, you can use AcraWriter library, which generates AcraStructs and helps you integrate it as a type into your ORM or database management code. You will need Acra’s public key to do that. AcraStructs generated by AcraWriter are not readable by it — only the server has the right keys to decrypt it.
- You can connect to both AcraConnector and the database directly when you don’t need encrypted reads/writes. However, increased performance might cost you some design elegance (which is sometimes perfectly fine when it’s a conscious decision).
Acra also has additional smaller components like AcraCensor firewall and a lightweight HTTP web server for managing AcraServer’s certain configuration options AcraWebConfig. To better understand the architecture and data flow, please refer to Architecture and data flow section in the official documentation.
The typical Acra workflow looks like this:
- The app encrypts some data using AcraWriter, generating AcraStruct with AcraServer public key and updates the database.
- The app sends SQL request through AcraConnector, which forwards it to AcraServer.
- AcraServer passes each query through AcraCensor (currently only works with MySQL databases), which can be configured to blacklist or whitelist some queries. AcraServer forwards the allowed queries to the database.
- Upon receiving the answer, AcraServer tries to detect the encrypted envelopes (AcraStructs). If it succeeds, AcraServer decrypts payload and replaces the AcraStructs with plaintext answer, which is then returned to AcraConnector over a secure channel.
- AcraConnector then provides an answer to the application, as if no complex security tool was ever working within the system.
Changelog v0.85
Core:
- Breaking changes:
Introducing a new more flexible configuration format for AcraCensor rules. AcraCensor doesn’t support the old format, all users should migrate (don’t worry, it’s a simple procedure).
- Search through encrypted data
You now can run SQL queries over encrypted AcraStructs allowing users to search through sensitive data without exposing it. This feature is only available in Acra Enterprise version.
- Transparent proxy mode
TLDR: Transparent proxy mode allows you to configure AcraServer to encrypt records in specific database columns without altering the application code.
The application flow doesn’t need to change: application sends SQL requests through AcraConnector and AcraServer to the database. AcraServer parses each request, encrypts the desired values into AcraStructs, and passes the modified requests to the database. To retrieve the decrypted data, your application talks to AcraServer again: upon receiving the database response, AcraServer tries to detect AcraStructs, decrypts them, and returns the decrypted data to the application.
Transparent proxy mode is useful for large distributed applications where updating the source code of each client app separately would be complicated.
To enable this mode, you need to create a separate encryptor configuration file (
acra-encryptor.yaml) that describes which columns to encrypt and provide a path to it in the AcraServer configuration file (or via CLI params--encryptor_config_file=acra-encryptor.yaml).Read more details in the Readme and in the Acra documentation section dedicated to Transparent encryption.
- AcraCensor – SQL firewall to prevent SQL injections
TLDR: Improved stability of AcraCensor, switched to more flexible rules’ configuration.
Breaking changes: Introducing a new format for configuration files, the previous format is no longer supported, you should migrate to the new one.
- New configuration file format allows configuring the allowlist and the denylist separately or simultaneously.
The
allowhandler allows something specific and restricts/forbids everything else. Theallowallhandler should be a final statement as that means that all the other queries will be allowed.The
denyhandler allows everything and forbids something specific. Thedenyallmeans “block all queries!” (that haven’t been allowed or ignored before).For each handler, there are settings that regulate queries, tables, and patterns. The order of priority for the lists is defined by their position in the configuration file. The processing priority for each list is as follows: queries, followed by tables, followed by patterns.
Read more in AcraCensor docs.
- Added version to the configuration file. This allows detecting an outdated configuration easily. From now on, AcraCensor supports explicit configuration version and logs errors if the configuration is not valid (#321).
- Improved parsing of SQL queries with prepared statements (#303, #283).
- Improved error handling for queries that AcraCensor can’t parse (#291, #284).
- Added ability to log unparsed queries to a separate log file for the debugging and configuration purposes. Sometimes AcraCensor can’t parse all of the incoming queries and it is useful to have a separate log for them.
How to use it: Provide the path to the unparsed queries log file in the configuration file
parse_errors_log: unparsed_queries.log(#295). - Improved support of PostgreSQL queries (
"RETURNING"clause) and quoted identifiers (now you can use"tablename"andWHERE "column"=1) (#296). - Fixed the bug in QueryCapture log that caused duplicated of records in the log to appear (#318).
- More…
- New configuration file format allows configuring the allowlist and the denylist separately or simultaneously.
Install && Use
Copyright 2015 Cossack Labs Limited
